panva / openid-client

OAuth 2 / OpenID Connect Client API for JavaScript Runtimes
MIT License
1.83k stars 392 forks source link

How to add state in auth url #188

Closed haanamomo closed 5 years ago

haanamomo commented 5 years ago

I find that theauthorizationUrl method would take the following parameter

export interface AuthorizationUrlParameters {
    readonly redirect_uri?: string;
    readonly response_type?: string;
    readonly scope?: string;

    readonly response_mode?: string;
    readonly nonce?: string;
    readonly resource?: string;
    readonly code_challenge?: string;
    readonly code_challenge_method?: string;
}

I cannot find a place to pass state to create the auth url, so now I just append state to the string

client.authorizationUrl({
            scope: 'openid',
            code_challenge: codeChallenge,
            code_challenge_method: 'S256',
          }) + '&state=testtestme'

Is there a right way to pass state?

panva commented 5 years ago

You should read docs rather than incomplete unofficial typings

https://github.com/panva/node-openid-client/blob/master/docs/README.md#clientauthorizationurlparameters

any other authorization parameters may be provided

haanamomo commented 5 years ago

Find the right way to pass in state:

client.authorizationUrl({
            scope: 'openid',
            code_challenge: codeChallenge,
            code_challenge_method: 'S256',
            state: 'testtestme',
          } as any)
panva commented 5 years ago

That is not the right way with the upcoming official types being developed in #184, you don't need to pass as any in those since AuthorizationParameters not only enumerates all known to me today but also [key: string]: unknown; making you able to pass in any parameter the way you should according to the official documentation.

haanamomo commented 5 years ago

The version I use is "@types/openid-client": "^3.1.6". There is no [key: string]: unknown in AuthorizationParameters interface

panva commented 5 years ago

I reiterate, once more, @types/openid-client is not official and any issues you have with it should be directed at its authors.

Once #184 lands openid-client will bundle its own types and I will ask the authors of the incomplete types to retire it.

haanamomo commented 5 years ago

OK, I understand now, when the official type of openid-client releases, I will change the code. Thanks for reply!